expressjs
diff --git a/‎History.md
Copy file name to clipboardExpand all lines: History.md
+5Lines changed: 5 additions & 0 deletions b/‎History.md
Copy file name to clipboardExpand all lines: History.md
+5Lines changed: 5 additions & 0 deletions
diff --git a/‎lib/response.js
Copy file name to clipboardExpand all lines: lib/response.js
+1Lines changed: 1 addition & 0 deletions b/‎lib/response.js
Copy file name to clipboardExpand all lines: lib/response.js
+1Lines changed: 1 addition & 0 deletions
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Deprecate `res.location("back")` and `res.redirect("back")` magic string
+
 4.20.0 / 2024-09-10
 ==========
   * deps: serve-static@0.16.0
 
@@ -916,6 +916,7 @@ res.location = function location(url) {
 
   // "back" is an alias for the referrer
   if (url === 'back') {
+    deprecate('res.location("back"): use res.location(req.get("Referrer") || "/") and refer to https://dub.sh/security-redirect for best practices');
     loc = this.req.get('Referrer') || '/';
   } else {
     loc = String(url);